FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I get a single WAF report for the whole device (Global WAF Report)? ​

Short answer

Yes. The Global WAF Report screen (WAF → Global WAF Report) combines the records of all WAF-protected vServices in a single report. The form opened with Generate Report is the same as the WAF Report form on the vService; in addition, there is the vService field: the default All vServices covers all vServices, and with Pick vServices the selected ones are scanned (if the selection is left empty, all vServices are again covered). The report starts with the All vServices section, and then the vServices that received attacks are sorted by attack volume; the vService and host group distribution is added to the Overview view. The formats are HTML, PDF and XLSX. The scan uses the same infrastructure as Global WAF Event Log: the time budget is at most 5 minutes and at most two device-wide scans run at the same time. The report can also be received regularly by e-mail: a single schedule is defined across the device on the Periodic Reporting tab. The screen does not appear on accounts whose permission is limited to certain vServices.

Problem: A Single Device-Wide Document Is Needed ​

While there are multiple WAF-protected vServices on the device, producing a separate WAF Report for each of them and combining the tables manually takes time. The total attack load of the device and the distribution of this load among the applications need to be seen in a single document.

Solution: Two Methods ​

Your situationSuitable method
Getting the report now (HTML, PDF, XLSX)Method 1: Generating the Global WAF Report
Receiving the report regularly by e-mailMethod 2: Periodic Reporting tab
  • How it worksGlobal WAF Report scans the records of the WAF-protected vServices in the selected period from the newest to the oldest and combines them in a single report; in a cluster setup, the records of both devices are used together.
  • Where it is openedWAF → Global WAF Report
  • Requirement WAF permission; an account whose permission is not restricted to specific vServices (how to access)
  • vService type HTTP (only the vServices whose WAF box is checked)

Step-by-Step Configuration ​

1
Adım 1 Open the screen

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → Global WAF Report is selected. The screen has the report tab and the Periodic Reporting tab (the tabs of the screen).

2
Adım 2 Open the report form

The Generate Report button on the report tab is clicked (Generate Report screen).

3
Adım 3 Select the format and the period

Report Type (html, xlsx, pdf) and Date are selected (default the last 1 day).

4
Adım 4 Select the scope

The vService field is in the default All vServices position. If only some vServices are to be reported, the switch is set to the Pick vServices position and the vServices are selected; the records of the ones not selected are not scanned at all.

5
Adım 5 Set the language, the row limit and the filter (if needed)

For xlsx and pdf, Report Language, the row limit of the selected type and Report Filter are set as in the vService report (How do I set the report language and the maximum number of rows in a report?). The Report Filter catalog also has a vService field.

6
Adım 6 Generate the report

Accept is clicked. If the scan budget runs out, the Results are complete back to … strip is displayed at the top of the screen; this strip is updated only while the HTML report is being produced (the scope of the scan and the warnings).

SectionContent
All vServicesThe combination of all vServices; in the Overview view, the vService and host group distribution (The difference in the Overview view)
vService sectionsThe same breakdowns for each vService that received attacks; the host groups of the vService are combined in a single total. A vService that has no record in the period does not open a section

Verification ​

1HTML reportTR7 side

The section selector on the report and the Overview view are examined.

ExpectedFirst section All vServices; in Overview, a distribution table with vService and Host Group columns
On the PDF and XLSX cover and in the file name, All vServices is written as the scope name even if a vService selection has been made.

Method 2: Periodic Reporting Tab ​

  • How it works The report that covers the whole device is sent as an e-mail attachment in the selected periods at the same times as the vService reports (Daily 07:30, Weekly Monday 03:30, Monthly the 1st of the month 05:30, Annual 1 January 06:30); the setting is single across the device and is off by default.
  • Where it is openedWAF → Global WAF Report → Periodic Reporting tab
  • Requirement Full permission in the WAF area; E-mail Settings (SMTP); at least one recipient address
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the Periodic Reporting tab

The Periodic Reporting tab is selected; the existing setting is displayed as a summary.

2
Adım 2 Open the edit tab

Edit is clicked; a closable Edit tab opens (Periodic Reporting Edit screen).

3
Adım 3 Fill in the fields

E-mail Report is turned on; E-mail Addresses, E-mail Report Content (pdf, xlsx) and E-mail Frequency (Daily, Weekly, Monthly, Annual) are filled in.

4
Adım 4 Save

Save is clicked. The scheduled global report covers all vServices, is produced in the default language of the device and does not use the form selections on the screen; in a cluster setup, only device number 1 sends it.

Verification ​

1Setting summaryTR7 side

The summary lines on the Periodic Reporting tab are examined.

ExpectedE-mail Report on; the addresses, the content and the periods are listed

Common Mistakes ​

  • Turning on Pick vServices and leaving it empty. If the selection is empty, the report again covers all vServices and no separate warning is given.
  • Producing a file report with a wide range and not checking the scope. The scan is limited by a 5-minute budget; the date range on the PDF and XLSX cover is the scanned range. The scope is first checked with the HTML report.
  • Mistaking the busy warning for an error. At most two device-wide scans run at the same time; the quota is shared with Global WAF Event Log and the device-wide Bot/DDoS log scan. When Another global scan is running right now — please try again shortly is seen, the operation is retried after a short time.
  • Expecting to find the report after leaving the screen. The report is not stored; when the screen is left, the produced HTML report is lost.
  • Not entering an address in the global schedule. The global scheduled report is not sent unless at least one address is defined.

How it is done in the documentation

Related questions